4 ms·

Stop it with this cloak and dagger BS. Just set a shared secret on it: https://github.com/google/tcpauth https://github.com/google/tcpauth (Yes, MD5 is safe fo

Stop it with this cloak and dagger BS. Just set a shared secret on it: https://github.com/google/tcpauth https://github.com/google/tcpauth (Yes, MD5 is safe for this use) With tcp MD5 your connection is even secured against an active attacker who can sniff. They can't inject, or even RST the connection. Even if they can sniff and spoof everything.

lucb1e 5y ago
> Yes, MD5 is safe for this use Sure, it just begs the question: why in the world would you still try to find nails for the hammer called MD5 when (according to Wikipedia) cryptographers recommended upgrading to SHA-1 in 1996 already? This project's first commit was well, well beyond the deprecation of MD5. It's a bit safer than but also not entirely unlike putting a Windows 7 on the internet just because there are no known exploits in an up-to-date 7 system currently.
- dogma1138 5y ago
  Cryptographers usually recommend switching to function X for usecase Y. Despite SHA1 today and MD5 for even longer being “insecure” for some use cases there are plenty of usecases for which they are still secure and will remain so. The reason for a wide deprecation is that most people can’t evaluate a hash function or an encryption algorithm in context well so it’s easier to say simply don’t use X. RSA is also crap for many things and it’s slowly but surely being deprecated but it doesn’t mean it’s completely broken for every usecase. Just to be clear I’m not stating that MD5 is necessarily safe for the usecase the GP states it is.
  - lucb1e 5y ago
    Okay but that doesn't explain why it makes sense to still pick an algorithm that more and more holes are being found in when every library already ships more modern alternatives. It would be better to remove the old MD5 code so we can't accidentally have someone use it for use-cases for which it isn't secure, but if people are pedantic about "but for this case I can still use it! Let me just do that!" that will just never happen and we're stuck with MD5 indefinitely.
    - dogma1138 5y ago
      I’m not going to evaluate if MD5 is safe for “tcpauth” even if I was competent enough to do so. If confidentiality isn’t a factor (since any hush function that is fast m enough to brute force isn’t going to be particularly secure) and if integrity cannot be compromised through collisions then the hash function is safe for this usecase. Why use MD5? It’s relatively easy to implement securely m, there are a lot of safe implementations and it’s fast. This is why CRC32 is still used today also.
      - mlyle 5y ago
        CRC32 is used for its error detection properties which exceed those of a cryptographic hash of the same length (and, to boot, it's cheaper, too). There's no reason to choose MD5 over SHA-1. It's less secure and slower and there's plenty of free implementations of SHA-1. Ideally you'd use SHA-256, because of (smaller) security concerns with SHA-1, but it is a small touch slower than MD5.
        boring_twenties 5y ago
        MD5 is quite a bit faster on my machine. % for i in md5 sha1 sha256 sha512; do echo -n "$i: "; time ${i}sum test.bin > /dev/null ; done md5: ${i}sum test.bin > /dev/null 1.37s user 0.13s system 99% cpu 1.501 total sha1: ${i}sum test.bin > /dev/null 1.84s user 0.12s system 99% cpu 1.952 total sha256: ${i}sum test.bin > /dev/null 4.43s user 0.16s system 99% cpu 4.593 total sha512: ${i}sum test.bin > /dev/null 2.69s user 0.12s system 99% cpu 2.810 total Surprisingly, SHA256 is much slower than SHA512 here.
        mlyle 5y ago
        OK, I measured a dozen machines, and I found a very mixed picture using 'openssl speed'. - Lots of modern x86 machines with SHA-NI that were typically 50-300% faster than MD5 - Older Intel machines, where SHA1 was generally slightly faster, with one or two exceptions where the reverse was true. - ARM machines with good SIMD/NEON where the NEON implementation of SHA1 was 30-40% faster than MD5. - Embedded ARM machines with bad SIMD/NEON where it was pretty much a tie. - A few ARM machines-- most notably Broadcom chipsets in the Raspberry Pi, where MD5 wins big a large margin. - Embedded MIPS 24k, where MD5 won by 33%. Then I found http://bench.cr.yp.to/results-hash.html http://bench.cr.yp.to/results-hash.html , which bears out what I'd measured. In any case, I don't think "speed" is any reason to select MD5, unless maybe if you're on MIPS 24k.
- thomashabets2 5y ago
  I'm not finding ways to to use MD5. TCP MD5 is supported on Linux and BSDs, and TCP-AO isn't. TCP MD5 has been used for decades to protect BGP, and exactly because it's still safe there's been no push to add TCP-AO. And it inherently requires kernel support, because it's part of TCP, not the application. I would have preferred TCP-AO (RFC5925), not TCP MD5 (RFC2385), but the former is not supported anywhere. See more at https://blog.habets.se/2019/11/TCP-MD5.html https://blog.habets.se/2019/11/TCP-MD5.html (I should have added this link in my comment, but I forgot I wrote a blog post on the topic)
tptacek 5y ago
If this is a joke, it is very well executed.
- ffk 5y ago
  It's not a joke, BGP servers used to authenticate each other with this in the late 90s. This was also before NAT was really a thing.
  - walrus01 5y ago
    a very small percentage of ISPs at some major IX points still want MD5 auth on BGP sessions across the fabric. Usually a moot point these days since the IX operator should have solid, reliable documentation of exactly what switch port and fiber patch panel assignment goes to which cage/suite/cabinet and ISP. Or in the case of a PNI between two ISPs over their own cross connect, you absolutely want to have a mutual level of trust and cooperation between the BGP peers on both sides of the session. And then other more modern methods of verifying that the IP blocks you're seeing from some other AS are legit, like verifying their RPKI signatures, IRR entries, etc.
    - thomashabets2 5y ago
      Citation needed. The ISPs I've worked for run this pretty much everywhere. I mean it's the only auth that exists for BGP, so why would you not want it?
      - walrus01 5y ago
        Citation needed: I've maintained direct sessions over the fabric (not via route servers) between my AS and peers' ASes, with over a hundred ISPs, at some of the world's largest IXes. Out of those more than a hundred, maybe 3 used MD5. We also have a lot of PNIs direct with other carriers with POPs in the same building. Sorry I obviously can't provide a copy/paste of the junos config showing all the peers.
  - thomashabets2 5y ago
top_post 5y ago
Heh guess I can cross this off my ideas list. 100% this is the way to go.
ekarulf 5y ago
Is this just spiped with MD5 instead of HMAC-SHA256? https://www.tarsnap.com/spiped.html https://www.tarsnap.com/spiped.html
- cperciva 5y ago
  No, spiped also encrypts data.
- thomashabets2 5y ago
  No, this is part of the TCP layer, which is why it can even protect against RST packets.

lucb1e 5y ago

> Yes, MD5 is safe for this use Sure, it just begs the question: why in the world would you still try to find nails for the hammer called MD5 when (according to Wikipedia) cryptographers recommended upgrading to SHA-1 in 1996 already? This project's first commit was well, well beyond the deprecation of MD5. It's a bit safer than but also not entirely unlike putting a Windows 7 on the internet just because there are no known exploits in an up-to-date 7 system currently.

dogma1138 5y ago
Cryptographers usually recommend switching to function X for usecase Y. Despite SHA1 today and MD5 for even longer being “insecure” for some use cases there are plenty of usecases for which they are still secure and will remain so. The reason for a wide deprecation is that most people can’t evaluate a hash function or an encryption algorithm in context well so it’s easier to say simply don’t use X. RSA is also crap for many things and it’s slowly but surely being deprecated but it doesn’t mean it’s completely broken for every usecase. Just to be clear I’m not stating that MD5 is necessarily safe for the usecase the GP states it is.
- lucb1e 5y ago
  Okay but that doesn't explain why it makes sense to still pick an algorithm that more and more holes are being found in when every library already ships more modern alternatives. It would be better to remove the old MD5 code so we can't accidentally have someone use it for use-cases for which it isn't secure, but if people are pedantic about "but for this case I can still use it! Let me just do that!" that will just never happen and we're stuck with MD5 indefinitely.
  - dogma1138 5y ago
    I’m not going to evaluate if MD5 is safe for “tcpauth” even if I was competent enough to do so. If confidentiality isn’t a factor (since any hush function that is fast m enough to brute force isn’t going to be particularly secure) and if integrity cannot be compromised through collisions then the hash function is safe for this usecase. Why use MD5? It’s relatively easy to implement securely m, there are a lot of safe implementations and it’s fast. This is why CRC32 is still used today also.
    - mlyle 5y ago
      CRC32 is used for its error detection properties which exceed those of a cryptographic hash of the same length (and, to boot, it's cheaper, too). There's no reason to choose MD5 over SHA-1. It's less secure and slower and there's plenty of free implementations of SHA-1. Ideally you'd use SHA-256, because of (smaller) security concerns with SHA-1, but it is a small touch slower than MD5.
      - boring_twenties 5y ago
        MD5 is quite a bit faster on my machine. % for i in md5 sha1 sha256 sha512; do echo -n "$i: "; time ${i}sum test.bin > /dev/null ; done md5: ${i}sum test.bin > /dev/null 1.37s user 0.13s system 99% cpu 1.501 total sha1: ${i}sum test.bin > /dev/null 1.84s user 0.12s system 99% cpu 1.952 total sha256: ${i}sum test.bin > /dev/null 4.43s user 0.16s system 99% cpu 4.593 total sha512: ${i}sum test.bin > /dev/null 2.69s user 0.12s system 99% cpu 2.810 total Surprisingly, SHA256 is much slower than SHA512 here.
        mlyle 5y ago
        OK, I measured a dozen machines, and I found a very mixed picture using 'openssl speed'. - Lots of modern x86 machines with SHA-NI that were typically 50-300% faster than MD5 - Older Intel machines, where SHA1 was generally slightly faster, with one or two exceptions where the reverse was true. - ARM machines with good SIMD/NEON where the NEON implementation of SHA1 was 30-40% faster than MD5. - Embedded ARM machines with bad SIMD/NEON where it was pretty much a tie. - A few ARM machines-- most notably Broadcom chipsets in the Raspberry Pi, where MD5 wins big a large margin. - Embedded MIPS 24k, where MD5 won by 33%. Then I found http://bench.cr.yp.to/results-hash.html http://bench.cr.yp.to/results-hash.html , which bears out what I'd measured. In any case, I don't think "speed" is any reason to select MD5, unless maybe if you're on MIPS 24k.
thomashabets2 5y ago
I'm not finding ways to to use MD5. TCP MD5 is supported on Linux and BSDs, and TCP-AO isn't. TCP MD5 has been used for decades to protect BGP, and exactly because it's still safe there's been no push to add TCP-AO. And it inherently requires kernel support, because it's part of TCP, not the application. I would have preferred TCP-AO (RFC5925), not TCP MD5 (RFC2385), but the former is not supported anywhere. See more at https://blog.habets.se/2019/11/TCP-MD5.html https://blog.habets.se/2019/11/TCP-MD5.html (I should have added this link in my comment, but I forgot I wrote a blog post on the topic)

tptacek 5y ago

If this is a joke, it is very well executed.

ffk 5y ago
It's not a joke, BGP servers used to authenticate each other with this in the late 90s. This was also before NAT was really a thing.
- walrus01 5y ago
  a very small percentage of ISPs at some major IX points still want MD5 auth on BGP sessions across the fabric. Usually a moot point these days since the IX operator should have solid, reliable documentation of exactly what switch port and fiber patch panel assignment goes to which cage/suite/cabinet and ISP. Or in the case of a PNI between two ISPs over their own cross connect, you absolutely want to have a mutual level of trust and cooperation between the BGP peers on both sides of the session. And then other more modern methods of verifying that the IP blocks you're seeing from some other AS are legit, like verifying their RPKI signatures, IRR entries, etc.
  - thomashabets2 5y ago
    Citation needed. The ISPs I've worked for run this pretty much everywhere. I mean it's the only auth that exists for BGP, so why would you not want it?
    - walrus01 5y ago
      Citation needed: I've maintained direct sessions over the fabric (not via route servers) between my AS and peers' ASes, with over a hundred ISPs, at some of the world's largest IXes. Out of those more than a hundred, maybe 3 used MD5. We also have a lot of PNIs direct with other carriers with POPs in the same building. Sorry I obviously can't provide a copy/paste of the junos config showing all the peers.
- thomashabets2 5y ago

top_post 5y ago

Heh guess I can cross this off my ideas list. 100% this is the way to go.

ekarulf 5y ago

Is this just spiped with MD5 instead of HMAC-SHA256? https://www.tarsnap.com/spiped.html https://www.tarsnap.com/spiped.html

cperciva 5y ago
No, spiped also encrypts data.
thomashabets2 5y ago
No, this is part of the TCP layer, which is why it can even protect against RST packets.